Tag: Access control
The UK’s data-protection landscape is evolving fast, and SMEs are now directly exposed to enforcement action once largely associated with public bodies or large multinationals. As the BDO enforcement trends analysis reviewing ICO enforcement trends 2025, highlights, the ICO is increasingly focused on fundamental compliance failures rather than technical edge cases, meaning SMEs face the same expectations as larger organisations.
To help UK SMEs stay ahead, this guide breaks down the three most prominent ICO enforcement themes in 2025 and explains how each relates directly to the core duties under UK GDPR.
ICO Enforcement Trend 1: DSAR Delays & Right-of-Access Failures
The ICO continues to treat DSAR delays as one of the most serious indicators of poor governance. This theme appears repeatedly in enforcement notices and aligns closely with the BDO analysis.
A recent example is the enforcement notice issued to South Wales Police, requiring the organisation to clear a backlog of more than 350 overdue SARs by mid-2026.
Although policing bodies sit in a unique context, the principle is identical for SMEs:
a delayed, incomplete, or mismanaged DSAR is a governance failure, not an administrative error.
Why SMEs are vulnerable
- DSAR processes are often informal or undocumented
- Staff rely on untracked shared inboxes that hamper compliance
- Manual redaction takes longer than expected and slows response times
- Identity verification checks are inconsistent or incomplete
- No clear owner is assigned to coordinate DSAR responses
Consequently, SMEs often fail “by accident”, simply because processes were never clearly built.
What SMEs should do
- Implement a formal DSAR register
- Use standardised verification templates
- Assign responsibility for triage and drafting
- Create a redaction decision record
- Test your DSAR workflow every six months
See how Athlex Data Protection can help you with your UK GDPR compliance.
To strengthen your position, Athlex Data Protection includes DSAR review as part of its Free UK GDPR Compliance Audit.
ICO Enforcement Trend 2: System Errors & Data-Accuracy Failures
While many SMEs assume breaches are caused by sophisticated threat actors, the ICO’s recent fines show that basic security failings, particularly around access control and system configuration, remain the driving force behind most incidents. This is why BDO identifies weak security controls as a recurring enforcement theme.
A clear example of this is the £3.07 million fine issued to Advanced Computer Software Group (“Advanced”), a major processor used across the UK health and education sectors.
What happened
A ransomware attack exploited several preventable vulnerabilities, including:
- inadequate access controls,
- outdated software components,
- unpatched critical systems, and
- insufficient segregation of sensitive data.
Because Advanced was acting as a data processor, the incident demonstrated that processors are not insulated from ICO enforcement. Importantly, the ICO highlighted that robust Article 32 security measures apply equally to processors and controllers — a point many SMEs overlook when relying on third-party suppliers.
Why this matters for SMEs
Many SMEs rely on external IT providers, SaaS dashboards, or outsourced infrastructure. Consequently, they often inherit a false sense of security. Yet, as the Advanced case shows:
- unpatched systems,
- misconfigured access rights, and
- weak administrator controls can create breach pathways that affect both the processorand its clients.
Furthermore, the ICO’s commentary stresses that technical misconfiguration is increasingly treated as a governance failure, not an unavoidable risk. In other words, SMEs are expected to demonstrate continuous security management – not reactive fixes after an incident.
What SMEs should do now
To reduce exposure to similar enforcement action:
- Conduct regular patch-management reviews and document them.
- Enforce multi-factor authentication onevery administrative and remote-access account.
- Validate that third-party systems use secure configuration baselines.
- Request evidence: recent pen-test summaries, MFA logs, and architecture diagrams showing data segregation.
ICO Enforcement Trend 3: Supply-Chain & Vendor Risk Is Now the Biggest Exposure
BDO notes that third-party suppliers are involved in a significant proportion of enforcement cases. This is evident across recent ICO actions.
A major example is the £14 million fine issued to Capita following a cyber incident that exposed the data of over 6 million people.
The ICO criticised:
- slow isolation of the breach,
- insufficient monitoring,
- weak patching practices, and
- inadequate oversight of third-party systems.
Similarly, the Upper Tribunal’s Clearview ruling confirmed that even overseas vendors fall under UK GDPR if they monitor UK residents.
Why SMEs must pay attention
SMEs are more dependent than ever on external providers – IT contractors, payroll services, marketing platforms, CRMs, SaaS tools, cloud storage, etc. Consequently, the regulator expects SMEs to:
- verify supplier security
- assess processors before onboarding
- maintain a vendor register
- require evidence of compliance
- include audit rights and termination clauses
In other words, your compliance is only as strong as your weakest vendor.
What SMEs should do
- Inventory all suppliers with data access
- Request evidence: certifications, test summaries, logs
- Ensure processor contracts meet Article 28 requirements
- Assess vendors annually (high-risk: quarterly)
The Athlex Data Protection free audit highlights exactly where your vendor chain poses compliance risk.
ICO Enforcement Trend 4: Governance, Documentation & Accountability Are Under the Microscope
BDO’s report highlights that the ICO is increasingly examining how decisions are made, not just whether breaches occur. Good governance – leadership awareness, documented decisions, risk logs, and internal reporting structures — is now a major enforcement factor.
This aligns with the ICO’s call for views on new enforcement-procedural guidance, signalling more transparent and structured regulatory processes.
This means SMEs are expected to show:
- clear data-protection ownership
- leadership engagement
- meaningful internal reporting
- documented risk assessments and decisions
- evidence of proactive compliance
How SMEs Can Stay Ahead – Starting Today
To prepare for these enforcement trends, SMEs should immediately focus on:
✔ DSAR workflows
✔ Data-accuracy controls
✔ Vendor oversight
✔ Incident readiness
✔ Governance documentation
And the simplest way to begin?
Use Athlex Data Protection’s Free UK GDPR Compliance Audit tool.
To read more about the biggest UK GDPR risks for SMEs, see our blog: Inside Out: Why Insider Risk Is the Biggest UK GDPR Blind Spot for SMEs.
It covers DSARs, access controls, vendor risk, system accuracy, governance, and incident readiness – all mapped into a clear action plan.
The risk that sits at your own desk
Most data incidents don’t start with outsiders. They start with someone who already has access: an employee exporting a list to a personal inbox “to finish later,” a contractor browsing records “out of curiosity,” or a former staff member whose account was never disabled. The UK Information Commissioner’s Office (ICO) expects organisations to prevent this through proportionate technical and organisational measures, and to assess and report personal data breaches appropriately. See the ICO’s guidance on personal data breaches.
Insider risk is the gap between “we have policies” and “we actually control who can see what, when, and why.” This guide turns that gap into seven practical controls you can implement this quarter.
7 Practical UK GDPR controls to reduce insider risk
1) Least-privilege access with clean joiner/mover/leaver (JML) flows
Do this:
- Map each role to specific datasets and grant only the minimum access required.
- Automate joiner, mover and leaver provisioning through your HRIS so accounts are created and removed promptly.
- Ban shared credentials and require multi-factor authentication on every account.
Outcome: Access is limited to what’s necessary, changes are applied promptly when people join, move or leave, and you can evidence necessity and proportionality under UK GDPR security and privacy-by-design requirements.
2) Evidence you can trust: logs and audit trails
Do this:
- Log views, exports, deletions and permission changes across core systems.
- Centralise logs and alert on unusual patterns, such as mass lookups or out-of-hours exports.
- A Security Information and Event Management tool helps, but start with built-in logs if that’s what you have.
Outcome: You can confirm what happened quickly, assess risk to individuals, and make accurate, timely notification decisions.
3) Stop the leak before it starts: Data Loss Prevention (DLP) and redaction
Do this:
- Configure DLP rules for email, cloud storage and endpoints.
- Auto-redact sensitive fields in routine exports and reports.
Outcome: Accidental oversharing is blocked by default, and special category data stays tightly controlled.
4) Device and workspace controls that actually work
Do this:
- Enrol all company and Bring Your Own Device (BYOD) endpoints in Mobile Device Management (MDM). Require disk encryption and screen lock.
- Disable local downloads for high-risk roles; restrict screenshots or copy/paste in sensitive apps where feasible.
Outcome: Data remains in managed environments and is harder to extract via quick workarounds.
5) Processor hygiene: vendor minimums and escalation paths
Do this:
- Bake minimum security measures, prompt breach notification, and audit rights into processor contracts.
- Maintain a single vendor risk register with owners and review dates.
Outcome: Third parties stop being “insiders by proxy” without accountability, and you have a clear path when something goes wrong.
6) Behaviour beats posters: training, nudges and sanctions
Do this:
- Run short, role-based refreshers using the workflows your teams actually use.
- Add in-tool nudges: “This export contains personal data. Do you need names?”
- Publish and apply a proportionate sanctions policy for misuse.
Outcome: People make better choices at the point of risk, and expectations are unambiguous.
7) Drill it: a 60-minute insider-incident playbook
Do this:
- Write a one-page runbook. Simulate it quarterly.
- Define who freezes access, who gathers evidence, who communicates to customers, and who speaks to the ICO.
Outcome: Response is coordinated and timely, with decisions recorded and defensible. Use the ICO’s security guidance hub to shape your thresholds and evidence checklist.
Why this matters: real-world expectations
Enforcement keeps landing where staff accessed records without a valid reason. Recent prosecutions include healthcare workers fined for snooping in patient records, underlining the need for access controls and audit trails. Example: ICO case report, Former NHS secretary found guilty of illegally accessing medical records.
For technical mitigations that specifically target insider misuse and data exfiltration, the National Cyber Security Centre (NCSC) provides concrete advice you can layer on top of policy and training: Reducing data exfiltration by malicious insiders.
The 60-minute plan when insider misuse is suspected
- Contain: Freeze the account, revoke tokens, stop syncs.
- Preserve evidence: Snapshot logs and systems before making changes.
- Scope: Identify what data, which data subjects, the lawful basis and intended purpose.
- Assess risk and notify if required: Inform affected individuals and the ICO based on risk to rights and freedoms, following the ICO’s thresholds and timelines.
- Document: Record decisions, timestamps, and people involved in your breach register.
- Remediate: Fix process gaps; update DLP rules and training.
- Follow-up: Close similar access gaps across roles and vendors; verify offboarding is watertight.
What to do this month: a 30-day insider risk checklist
- Access reviews on all high-risk systems
- JML automation turned on for HRIS and your Identity Provider (IdP)
- Export and bulk-view logging with alerts
- DLP pilot on email and cloud storage
- Processor addendum with breach information schedule
- Role-based refreshers booked
- One tabletop drill with your leadership team
- Validate your approach against the NCSC insider-exfiltration guidance
If you outsource checks or verification, you still carry the risk. Read out guide: Age verification and the UK GDPR in 2025: a plain-English SME guide.
Other things you can do:
- Get cover: Our Outsourced DPO service keeps these controls live, not just on a slide
- Talk to us: email us hello@athlex.co.uk to find out how we can help you
